Process

5170.3 - Process (Rev. 243; Issued: 06-12-26; Effective: 06-12-26; Implementation: 06-12-26) The CMS location evaluates the information required to be reported by the hospital or CAH DPU under 42 CFR 482.13(g)(1) to determine whether the situation might involve a violation of 42 CFR 482.13(e) through 42 CFR 482.13(g) and authorizes an on-site investigation if there appears to be a possible violation. Using the information provided by the hospital or CAH DPU in the worksheet, the CMS location evaluates whether the case warrants an on-site investigation. If the CMS location determines that the restraint/seclusion death report requires on-site investigation, within two business days of receiving the report, the CMS location enters the reported information into the ACTS restraint/seclusion module and immediately notifies the SA to authorize a complaint survey to investigate the hospital’s or CAH DPU’s compliance with the Patient’s Rights requirement at 42 CFR 482.13(e), (f), and (g), including the reported case. The SA accesses the ACTS restraint/seclusion module to see the information reported by the hospital or CAH DPU prior to conducting the on-site investigation. The SA is expected to be onsite to initiate the investigation within two business days of receipt of survey authorization from the CMS location. Notice to Protection and Advocacy Organizations At the same time that the CMS location notifies the SA that it authorizes the on-site survey, consistent with the ACTS Notice of a Modified or Altered System of Records (SOR) (71 FR 29643, May 23, 2006, SOR 09-70-0565), the CMS location also provides written notification, by mail or email, to the appropriate Protection and Advocacy Organization (P&A) within the State where the hospital is located, only if the P&A has a current Data Use Agreement (DUA) with CMS. The CMS location may contact CMS Central Office for a list of P&A’s with current DUAs. The names and addresses for each State’s P&A can be located at the following website, at the drop down menu entitled “Get Help in Your State:” www.ndrn.org . Notification is provided only in those cases for which an on-site survey is authorized. The CMS location provides the following information to the P&A: hospital or CAH DPU name, hospital or CAH DPU address, name of the deceased, and a copy of the restraint/seclusion death report submitted by the hospital or CAH DPU. An entry must be made on the intake in ACTS indicating the name of the P&A to which the restraint/seclusion death report data was sent and the date it was sent. The P&A must have an approved CMS Data Use Agreement (DUA), Form CMS-R- 0235, (Exhibit 292) in place before restraint/seclusion death report data may be disclosed to it. In order to get an approved DUA, the P&A must complete and submit a signed CMS DUA, Form CMS-R-0235, including an initialed DUA ACTS SOR- P&A Attachment (Exhibit 293) to the Director, Division of Information Security and Privacy Management (DISPM), Centers for Medicare and Medicaid Services, Mailstop N2-04-27, 7500 Security Boulevard, Baltimore, MD 21244-1850. DISPM will review the DUA, assign a unique DUA identifier and expiration date to it, and return a signed copy to the P&A, including an expiration date. CMS Central Office Survey and Certification will maintain and make available to CMS locations a list of P&As with DUAs. When completing the Form, P&As must note the following in particular: • Line 5 of the DUA must state “Restraint/Seclusion Hospital Death Reports.” The “Years” and “System of Record” columns should be left blank; • Line 12 must state “CMS DUA: ACTS SOR Attachment – P&A;” • The DUA must be signed by the P&A official whom the P&A designates as “Custodian,” i.e., the individual who will have actual possession of and responsibility for the data released under the DUA; and • A P&A may designate more than one Custodian, but if it does so, each individual must complete and sign a Multi-Signature Addendum Form (Exhibit 294). When approved, the DUA will have an expiration date. DISPM will alert an organization with a DUA of its upcoming expiration date and will give the organization the option of requesting a one-year DUA extension via e-mail, or to close the DUA with a DUA destruction certificate. DISPM has set up a DUA resource email box which accepts all expired DUA resolution requests at DataUseAgreement@cms.hhs.gov. Custodians may be added or deleted over the life of the primary DUA. To add a new Custodian under an existing DUA, the P&A must submit the following to CMS/DISPM: a letter from the P&A describing the activities planned for the new Custodian and the length of time over which the Custodian will serve, and a Multi-Signature Addendum signed by the appropriate official from the P&A. The Multi-Signature Addendum must show the DUA number of the existing primary P&A DUA. The P&A must assign a case number to all Multi-Signature Addendums beginning with “1” and adding consecutively thereafter. CMS/DISMP will use this number to track the number of Custodians in each P&A. When a P&A seeks to delete an existing Custodian, it must send the CMS/DISPM a letter to this effect. CMS/DISPM will strike out the name of the deleted Custodian from the DUA or Multi-Signature Addendum that added that Custodian, dating and initialing the deletion. The DUA process described in this section applies to disclosure of hospital and CAH DPU restraint/seclusion death reports by CMS to P&As in those cases where the P&A did not first make a request specific to an identified patient; a DUA is not required for other disclosures of information in ACTS to a P&A when permitted in accordance with the ACTS System of Records Notice. • A P&A may request information about an on-site survey by submitting its request to the SA. The SA will process this request and release information to the P&A in accordance with standard CMS policy for disclosure of Form CMS 2567, Statement of Deficiencies and Plan of Correction. If the P&A identifies a particular patient, hospital, and approximate date or dates when the patient was in that hospital or CAH DPU, and if the P&A makes a request for additional information, beyond the Form CMS 2567, related to use of restraint or seclusion on that patient, the request is forwarded to the CMS location. The CMS location may, in accordance with the ACTS System of Records Notice, release additional information to the P&A. NOTE: Sections 5200 to 5240 relate to all non-deemed provider/supplier types, excluding nursing homes (SNFs/NFs). NOTE: Sections 5200 to 5240 relate to all non-deemed provider/supplier types, excluding nursing homes (SNFs/NFs).